Data Protection Impact Assessments under GDPR: Article 29 Working Party Adopts Draft Guidelines

The EU General Data Protection Regulation's (GDPR) requirements are coming into focus quickly as EU data protection authorities continue to issue guidance on different aspects of the law. On April 4, 2017, the Article 29 Working Party (Working Party) continued this trend by adopting draft Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" for the purposes of Regulation 2016/679 (Guidelines). The Working Party is asking for comments regarding this draft document by May 23, 2017. The document will then likely be finalized at one of the upcoming plenary meetings of the Working Party.

The Guidelines are the Working Party's first step in seeking to promote common criteria, methodology, and recommendations with respect to DPIAs under the GDPR. Companies should take note, and they should begin to consider how they will integrate DPIAs into their day-to-day operations. As with other aspects of the